https://live.paloaltonetworks.com/t5/general-topics/issue-with-routing-possibly/m-p/547012#M111760 <P>Needing a little help. I have a PA 5220 within a secure enclave (so no connection to the internet). I can ping a gateway in another enclave without any issue but when I ping the network beyond that gateway I get no reply. My GW external interface and their GW external interface are on the same subnet and their internal network and my internal network are on the same subnet but a different subnet than what is on the external interfaces. I can ping their external GW from both my external and my internal interface but nothing beyond it. They have confirmed that the device that I am pinging in question is open to reply to everyone. The crazy thing is that when I ping anything within their internal network I get no response and the traffic capture on the switch (which sits between the 2 GWs) shows no traffic coming from my side whatsoever. So it seems like the ping is dying before it ever leaves the firewall. The traffic log shows "aged-out" and packet capture I run shows no response found. Also, currently for testing I have a route in the virtual router for quad zeroes (0.0.0.0/0). Again when I ping their GW I get a response but not anything from their internal (which is the same range as my internal NW) Any help would be appreciated!</P> Fri, 23 Jun 2023 14:22:30 GMT ChrisHerrin 2023-06-23T14:22:30Z https://live.paloaltonetworks.com/t5/general-topics/issue-with-routing-possibly/m-p/547012#M111760 <P>Needing a little help. I have a PA 5220 within a secure enclave (so no connection to the internet). I can ping a gateway in another enclave without any issue but when I ping the network beyond that gateway I get no reply. My GW external interface and their GW external interface are on the same subnet and their internal network and my internal network are on the same subnet but a different subnet than what is on the external interfaces. I can ping their external GW from both my external and my internal interface but nothing beyond it. They have confirmed that the device that I am pinging in question is open to reply to everyone. The crazy thing is that when I ping anything within their internal network I get no response and the traffic capture on the switch (which sits between the 2 GWs) shows no traffic coming from my side whatsoever. So it seems like the ping is dying before it ever leaves the firewall. The traffic log shows "aged-out" and packet capture I run shows no response found. Also, currently for testing I have a route in the virtual router for quad zeroes (0.0.0.0/0). Again when I ping their GW I get a response but not anything from their internal (which is the same range as my internal NW) Any help would be appreciated!</P> Fri, 23 Jun 2023 14:22:30 GMT https://live.paloaltonetworks.com/t5/general-topics/issue-with-routing-possibly/m-p/547012#M111760 ChrisHerrin 2023-06-23T14:22:30Z https://live.paloaltonetworks.com/t5/general-topics/issue-with-routing-possibly/m-p/547041#M111767 <P>Hello,</P> <P>For the enclave, verify you have routes in the virtual router. Also check the logs to see where/if the traffic is being denied. I usually put my enclaves into a different zone so security policies are the only way the traffic is allowed in/out.</P> <P>&nbsp;</P> <P>Regards,</P> <P>&nbsp;</P> Fri, 23 Jun 2023 16:42:04 GMT https://live.paloaltonetworks.com/t5/general-topics/issue-with-routing-possibly/m-p/547041#M111767 OtakarKlier 2023-06-23T16:42:04Z